PT-2026-90240

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the ath6kl cfg80211 connect event function. The issue occurs when the function subtracts fixed Information Element IE offsets from the assoc req len and...

PT-2026-90258

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function reads header fields before validating that the token is at least 16 bytes long. This can lead to out-of-boun...

PT-2026-90356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An underflow of the loff t type occurs in the cifs remap file range function when the len variable is 0. This happens because the effective length is calculated as len = src inode-i size...

PT-2026-96405

In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff t underflow in cifs remap file range when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = src inode-i size - off; If off i size, this is a negative loff t, corrupting the ByteCount i...

CVE-2026-89524: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89526: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

PT-2026-90248

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the pcl for each segment macro incorrectly calculates the upper bound when a parsed chunk list contains a chunk with a ch segcount of zero...

CVE-2026-89606: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

CVE-2026-89640: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

PT-2026-96503

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl cfg80211 connect event subtracts fixed IE offsets from assoc req len -= 4 and assoc resp len -= 6, both u8, with no lower bound. The aggregat...

PT-2026-90404

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the NFSv4 server. In the nfs4 preprocess seqid op function, the stateid is obtained via nfsd4 lookup stateid, which increments the sc count reference on the nf...

PT-2026-90309

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hugetlb component where the unmap hugepage range function can incorrectly adjust reservations. When a folio is mapped in both a parent and a child process, if the...

PT-2026-96512

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

PT-2026-90137

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the IPMB Intelligent Platform Management Bus component where the ipmb write function reads message fields before validating the length byte. This can lead to the reading o...

PT-2026-90192

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP Stream Control Transmission Protocol implementation where a cached RECONF chunk containing multiple request parameters can lead to an underflow of the outcnt...

PT-2026-90249

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Arithmetic defects in the svc rdma read chunk range function lead to incorrect DMA lengths and a u32 underflow. The issue occurs during the processing of a Read chunk's segment list when...

CVE-2026-89533: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

PT-2026-96541

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD OUT request again while another...

CVE-2026-89476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

Security Bulletin: IBM MQ Appliance is affected by a heap buffer underflow vulnerability (CVE-2026-10858)

Summary IBM MQ Appliance has addressed a heap buffer underflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing multi-segment messages. Vulnerability Details CVEID:CVE-2026-10858 DESCRIPTION: IBM MQ could...